NAB ecommerce Merchant Solutions. Getting Started Guide and Application Form

NAB ecommerce Merchant Solutions Getting Started Guide and Application Form Updated June 2012

Welcome to NAB ecommerce The following guide will help you navigate through the establishment of your NAB ecommerce Merchant Account. Read it carefully to get a thorough understanding of the application process and the benefits and responsibilities that come with your ecommerce merchant account. We wish you well as you establish your ecommerce business and look forward to helping you grow into the future. What you need to know about the application process Your application for a merchant account needs to contain as much relevant information as possible. This will help us to quickly assess your application, allowing your account to be up and running sooner. To help make the application process easier for you, we ve highlighted the most critical aspects of the application process. Be as specific as possible as this will make it easier for us to assess your application. What will we be checking? Your detailed completion of the application form helps us to understand your business, and what you might require from us. It also helps us to check things such as: Legal entity, owners & directors Trading names Settlement accounts Location, contact & industry Anticipated transaction types, volume and values Your website If you are replacing a merchant facility at another bank, we will also require recent merchant statements. How does your business operate? Before we can approve your NAB ecommerce Merchant Account, we need to accurately assess the potential exposures for both your business and ours. To help us do this, we need to be able to clearly understand the following: What does a cardholder buy from you? Identify the type of goods or services you sell. How do you engage with your customers? Is your business purely online or do you have a physical presence as well? Do you sell goods or services as a one-off transaction or by subscription? When does the cardholder receive the goods or services in full after payment? For example, 5 business days for delivery; or initial membership day one that is then valid for 12 months. Remember, the more information you can provide, the easier it is for us to quickly process your application. What happens next? Once your application has been through the initial assessment you will receive either: 1. Confirmation of approval (eg. Merchant number or NAB Transact details emailed to you); or 2. Communication regarding necessary website changes; and/or 3. Advice that we must undertake a more detailed credit assessment together with your relationship banking team. Understanding your ecommerce Merchant Account You can use your ecommerce merchant account for accepting card-not-present payments including: ecommerce: These transactions are used for taking one off customer payments that are initiated in real time. This is generally through a web site, but can also be integrated with other business applications. MOTO (Mail Order/Telephone Order): For mail orders, written authorisation is provided by the cardholder to charge their credit card. For telephone orders, you or your employees accept a verbal authorisation from the cardholder. Payment details are then submitted for processing. Recurring transactions: Involve charging a customer s credit card on a regular basis (eg. subscriptions, or automatic bill payments). To do this, you must establish a recurring authority with the cardholder. Mobile payments: Available through a version of NAB Transact specially formatted for mobile devices. Other payment gateways may also be able to provide this feature. To process transactions with your ecommerce Merchant Account you will need a payment gateway. NAB supports two different solutions: 1. NAB Transact: NAB s own payment gateway. It provides a range of hosted and fully integrated payment processing options. 2. Other payment gateway: You can use your NAB ecommerce Merchant ID with one of our accredited third party payment gateways. By providing the merchant account details to your chosen payment gateway, you can use their payment integration and processing integration services. This is referred to as Bureau Services in your Merchant Agreement. When using a third party gateway you will enter into a direct relationship with them for the processing and reporting of your transactions. You will be responsible for the fees and charges of your third party gateway in addition to NAB fees that relate to your NAB ecommerce Merchant Account. Page 2 of 9

Requirements for your website The most important aspect of our ecommerce relationship is your website it is, after all, your business shopfront. In addition to any Australian legal requirements, your website must include all of the information shown below. The format below is for illustrative purposes you should work with your web designer on a layout that suits your business. My Business Home About Us Contact Us 1. Your business name (and ABN as applicable). This will include (with our approval) the name that best identifies you for the purposes of the website. 2. The address of your physical place of business in Australia. 3. Your business contact details, including telephone and an email address. 4. Clear descriptions of the products or services being offered to customers, including the price in Australian dollars (or authorised currency). 5. Your refund and exchange policy, including the process for cancellation of a transaction by a cardholder. 6. Your delivery timeframes for goods and services. Delivery times must be appropriate for your type of business. 7. Details of any Australian export restrictions (if applicable). 8. Your privacy policy and how you intend to deal with, or share, personal information obtained from and about the cardholder. 9. A description of the measures you have in place to maintain the security of cardholders account data. Terms & Conditions Privacy & Security Your privacy policy It s essential that your customers know through your privacy policy what you re doing with the personal information collected during their transaction. This statement could cover the following: What customer data is collected and tracked (including if you use cookies). For what purposes the information will be used (be specific and advise if it will be used for marketing purposes). Who the information is shared with (name the types of third parties). The processes of you use to keep data secure (eg policies, restricted access for employees, etc). The process for customers to access or correct their information (provide a contact email address or telephone number). For tools and examples, you may wish to try a web search for website policy templates for Australia or refer to the website of the Federal Privacy Commissioner www.privacy.gov.au Your refund policy Your refund and exchange policy must be clearly spelled out and comply with the Australian Consumer Law (ACL). It is important to note that the consumer guarantees provisions of the ACL mean that businesses dealing with defective goods must provide a repair, replacement or refund. Where there is a major failure with an item, the consumer has the right to chose the remedy, including requesting a refund. Goods and services bought online must meet the same statutory conditions and warranties as for other kinds of sales. Consumers statutory rights are also the same. The ACCC has published a recommended refund policy on their website: Example refund policy We are not required to provide a refund or replacement if you change your mind. But you can choose a refund or exchange if an item has a major problem. This is when the item: has a problem that would have stopped someone from buying the item if they had known about it; is unsafe; is significantly different from the sample or description; or doesn t do what we said it would, or what you asked for and can t be easily fixed. Alternatively, you can choose to keep the item and we will compensate you for any drop in value. If the problem is not major, we will repair the item within a reasonable time. If it is not repaired in a reasonable time you can choose a refund or replacement. Please keep your proof of purchase e.g. your receipt. Page 3 of 9

Making ecommerce safer Fraud is one of the greatest threats to merchants who trade over the internet and through mail or telephone order. As they are at the frontline, it is the responsibility of these merchants to verify to the greatest extent possible the cardholder s identity and the validity of the transaction. Basic fraud control actions are listed below. It should be remembered that none of these tools should be used exclusively to determine the validity of the customer or to accept or reject an order. They should be used as indicators of risk, and in combination with other fraud detectors. Many of these tests can be conducted automatically. However, this will depend on the flexibility of your technical infrastructure or your ability to connect with fraud prevention service providers. Instead of manually reviewing each order, it is typically more cost effective to perform automated internal screening or to engage a third-party tool to screen for questionable transactions. Basic steps you can take to combat fraud 1. Obtain the three or four-digit card verification number from the cardholder (often referred to as CVV). The card verification number is a code printed on all Visa, MasterCard and American Express cards. From 1 April 2012, all ecommerce transactions must include the card verification number. An ecommerce transaction is defined as a payment accepted over the internet where the cardholder is entering the card details themselves. To maintain the security of the card, it s important that this number is not stored in your system therefore it s optional for mail/telephone orders. The purpose of the card verification number is to attempt to verify that the person placing the order has the actual card in his or her possession. Requesting the card verification number can add a measure of security to the transaction. 2. Effectively leverage your own customer history data. If you have had a fraud event associated with a customer, the details of that transaction should be added to internal negative lists. Any subsequent order that shares the same characteristics should be considered suspicious. 3. Orders that include several varieties of the same item: Having multiples of the same item increases a criminal s profits. 4. Rush or overnight shipping: Criminals want their fraudulently obtained items as soon as possible for the quickest possible resale and aren t concerned about extra delivery charges. 5. Multiple transactions on one card over a very short period of time: This could be an attempt to run a card until the account is closed. 6. Inconsistencies: Information in the order details such as a mismatch in the billing and shipping address, telephone area codes that aren t aligned with postal area codes, email addresses that don t look legitimate, and orders placed at unusual times of the day. 7. Shipping to a single address, but transactions placed on multiple cards: This could involve account numbers generated using special software, or even a batch of stolen cards. 8. Multiple transactions on one card or a similar card with a single billing address, but multiple shipping addresses: This could represent organised activity, rather than one individual at work. 9. Multiple cards used from a single IP address: More than one or two cards could indicate a fraud scheme. 10. Orders from internet addresses that make use of free e-mail services: As these e-mail services involve no billing relationships, there is often neither an audit trail nor any means to verify that a legitimate cardholder has opened the account. Using 3-D Secure services for cardholder authentication For internet (ecommerce) transactions, we recommend that you use 3-D Secure services to authenticate the cardholder s identity, utilising Verified by Visa and MasterCard SecureCode. The warning signs: 10 indicators of potential fraud Be alert for the following indicators and remember any of these factors could pose a high risk. 1. First-time shopper: Criminals are always looking for new merchants to steal from. 2. Larger-than-normal orders: Because stolen cards or account numbers have a limited life span, criminals need to maximize the size of their purchase. By utilising 3-D Secure technology, a cardholder is presented with an authentication page provided by the card issuer as part of the purchase process. Verified by Visa and MasterCard SecureCode offer chargeback protection for enrolled merchants on consumer (but not business and pre-paid) card products. Transactions are not processed if the cardholder fails the authentication process. Page 4 of 9

Shifting the balance In most instances, the use of 3-D Secure authentication will make the card issuer responsible for the chargeback liability on any fraudulent transactions. However, merchants will still remain liable for chargebacks related to the goods or services provided (eg. not as specified, goods not received, etc). It is important that you read through the terms and conditions around chargeback liability particularly regarding which cards are covered by 3-D Secure (for instance, commercial and pre-paid cards are generally not covered). 3-D Secure should not be considered a substitute for your own risk management practices you should continue to monitor high risk or suspicious sales. We recommend that you cancel and refund any order that seems suspicious. How it works The system runs off software known as a Merchant Plug-in (MPI), which must be connected to the web server that handles your payments. Alternatively, you can use the hosted services of your payment gateway or a specialist service provider. The 3-D Secure MPI provides transaction information to the card schemes and enables an authentication page that is hosted by the card issuer. This is presented within your website s payment page as part of your checkout process (example below). Cardholders use a password for authentication through 3-D Secure. The card issuer can also link the authentication process with their SMS security for internet banking. To complete the transaction, the cardholder must enter their password or code to verify their identity. If you re using NAB Transact Direct Post or Hosted Payment Page, you can access our hosted 3-D Secure MPI. If you use another payment gateway service, discuss options for 3-D Secure authentication with them. When completing your merchant application, let us know whether you wish to be registered with Visa and MasterCard for 3-D Secure authentication. Data security Looking after cardholder data Card data ranks amongst an individual s most important personal information. For this reason, your customers must be certain that their personal card data is secure at all times. In today s environment, there are a number of ways that cardholder data is transmitted, processed and stored. On the flipside, there are an equal number of ways for fraudsters to gain access to this information. Payment account data security is mandated globally by the Payment Card Industry Data Security Standards (PCI DSS, or just PCI ). This is governed by the PCI Security Standards Council. It s your responsibility as a merchant to keep cardholder data secure. Because a united front is the best way to minimise the chances of cardholder data getting into the wrong hands, we re more than happy to assist you with all matters relating to your PCI compliance. Making your obligations simple The easiest way to reduce your responsibilities with PCI is not to transmit, process or store card data through your systems. Most payment gateways will be able to provide you with solutions that transmit card data directly from your customer s computer to the payment gateway. These solutions may be hosted payment pages or integrated solutions that use an iframe or a transparent redirect such as NAB Transact Direct Post. If you offer recurring billing, your payment gateway you can store card details with the gateway and use a token to replace the card numbers in your system. If you are using an integrated API (Application Programming Interface) to submit transactions to your payment gateway, your systems are still within scope of the PCI standards. The reason for this is that an API connects with your web server, not the web page directly, so card data is decrypted and re-encrypted by your server as it is transmitted to the payment gateway. You will be required to validate that no residual card data is retained in your system s memory or log files. How you benefit from good data security PCI DSS protects cardholders and minimises the risk to your business. Among the many benefits of adhering to the PCI DSS requirements are: Protect customer data. Provide a complete health check for any business that stores or transmits customer information. Lower exposure to financial losses and remediation costs. Maintain customer trust and safeguard the reputation of their brand. For more information, please refer to our PCI DSS brochure which is available for download by clicking here. Page 5 of 9

Please note: ALL SECTIONS of this form need to be completed. If a box or section does not apply, please place N/A or NOT APPLICABLE in that box rather than leaving it blank. ANY AREAS THAT ARE LEFT BLANK MAY DELAY YOUR APPLICATION. NAB contact name: <xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx> Phone number <xxxx xxx xxx xxxxxxx> Fax <xxxx xxx xxx> Please use blue or black pen and write in BLOCK LETTERS Where did you hear about us? ecommerce Merchant Application Form NAB branch nab.com.au Advertising Other Business details Full legal name Trading name ABN ACN Merchant Name that you would prefer to appear on customer s credit card statement (subject to approval) (up to 20 characters) Business address Location address State Postcode Mailing address State Postcode Contact details Contact name Telephone Mobile number ( ) Fax number Email address ( ) Business website address Preferred contact time Preferred contact method Morning Afternoon Phone Email Proprietors/Directors Surname First name Middle name(s) DOB / / Surname First name Middle name(s) DOB / / Surname First name Middle name(s) DOB / / *If your business has more than 3 directors/proprietors, please provide details on a separate sheet. Page 6 of 9

Business account details BSB number Account number Account name Credit funds to BSB number Account number Account name Debit fees from Both nominated accounts must be BUSINESS ACCOUNTS. Personal accounts cannot be used. (You will need to complete a Direct Debit Request for non-nab accounts). I would like to open a new NAB business account Merchant facility history Are you a current merchant account holder with NAB? Yes No If yes, provide your Merchant Number Do you have merchant facilities at another financial institution? Yes No If Yes, please provide the three most recent merchant statements. Have you ever had a merchant facility terminated by a financial institution for any reason? Yes No If Yes, provide details Full description of business and sales processes It is important that your description answers the following questions. What does a cardholder purchase from you? How do you engage with your customers? When and/or how will the cardholder receive their goods or service from you? Nature of transactions Historic Projected Source Average number of credit card sales per month Face-to-Face Average credit card sale amount $ $ Mail/Telephone Total annual business turnover (includes cash, cheques, cards etc) $ $ Internet Recurring Total 100 Provide the percentage split of credit card sales in the following categories: Supply of goods/services Memberships/subscriptions What are the average number of days taken for delivery? How frequently are members/customers billed? eg. monthly/yearly Are all members/customers billed at the same time? Yes No Sale of gift certificates/coupons Other What is the expiry period? eg. 12 months Please specify Total 100 What payment gateway or service provider will you be using for processing card payments? NAB Transact Other payment gateway or service provider (insert name) How will you be submitting your card payments for processing? (refer to Data Security section on page 5) Virtual terminal or batched payments using tokenisation you are not storing card details in your own systems. Hosted payment page or transparent redirect card details are not transmitted via your systems (eg. NAB Transact Direct Post or Hosted Payment Page). API or batched payments you store and/or transmit card details via your own systems. Page 7 of 9

Additional features Please register me for 3-D Secure authentication (Verified by Visa and MasterCard SecureCode). NAB Transact I wish to accept American Express cards, using my existing Amex merchant number I wish to accept American Express cards and would like to establish a new American Express merchant facility. I wish to accept Diners Club cards using my existing Diners Club merchant number. If you do not have an existing Diners Club facility and wish to accept these cards, you must contact Diners Club directly to establish a new merchant facility. You can add your Diners Club merchant number to your NAB Transact service at any time. Website details What is the address (URL) of the website that you will be using for accepting payments? URL Please provide test URL and login details if required. URL User ID Password Website content Please confirm that your website includes the following information: Your business name (and ABN as applicable); and The address of your place of business in Australia (not a PO Box); and Your business contact details, including telephone and an email address; and Clear descriptions of the products and/or services being offered to customers, including price in relevant currency; and Your refund and exchange policy, including the process for cancellation of a transaction by a cardholder; and Your delivery timeframe for goods and services; and Details of any Australian export restrictions (if applicable); and Your privacy policy and how you intend to deal with, or share, personal information obtained from and about the cardholder; and A description of the measures you have in place to maintain the security of cardholders account data. Security Please refer to www.pcisecuritystandards.org/smb for payment data security guidelines. Larger businesses processing over 20,000 transactions per annum should refer to www.pcisecuritystandards.org/merchants for more detailed information. If requested by NAB, you will need to provide proof of compliance with the global Payment Card Industry Data Security Standards (PCI DSS) by completing a Self Assessment Questionnaire (SAQ) which can be downloaded from the PCI DSS websites shown above. If you use an external hosting or processing service provider they must also be compliant and you should ask to view their certification so that you can complete your SAQ. Application confirmation Before signing and/or submitting this form by email, please complete all sections of this application and read all of the important information on this form, including the Privacy and Collection of Information statement and the Authority and Declaration. By submitting this form to NAB, the Applicant acknowledges and declares that: The information submitted is true and correct; The Applicant has read the section headed Privacy and Collection of Information and makes the Declaration set out on the following page. Signature If submitting for a company, print full name and capacity for signing (e.g. Director) Date / / Page 8 of 9

Privacy and Collection of Information Acknowledgment and authority that credit information may be given to a credit reporting agency I/We understand that Section 18E(8)(c) of the Privacy Act 1988 (CTH) ( the Privacy Act ) allows the National Australia Bank Limited to give a credit reporting agency certain personal information about me/us which I/we authorise NAB to do. The information which may be given to a credit reporting agency is covered by Section 18E(1) of the Privacy Act and includes: Identity particulars as permitted by the Privacy Commissioner s determination issued under Section 18E(3) of the Privacy Act. The fact that I/we have applied for credit and the amount. The fact that NAB is a credit provider to me/us. Payments which become overdue more than 60 days and for which debt collection action has started. Advice that payments are no longer overdue. Cheques drawn by me/us for at least $100 which NAB has dishonoured more than once. In specified circumstances, that in the opinion of NAB, I/we have committed a serious credit infringement. That the credit provided to me/us by NAB has been discharged. Authority for NAB to obtain certain information To enable NAB to assess my/our application for personal or commercial credit, I/we authorise NAB: To obtain from a credit reporting agency a credit report containing personal credit information about me/us in relation to personal credit provided by NAB. To obtain from a credit reporting agency a credit report containing personal credit information about me/us in relation to commercial credit provided to me/us by NAB. This is in accordance with Section 18K(1)(b) of the Privacy Act. To obtain a report containing information about my/our commercial activities or commercial creditworthiness from a business which provides information about the commercial creditworthiness of a person in relation to personal credit provided to me/us by NAB. This is in accordance with Section 18L(4) of the Privacy Act. To obtain a report from a credit reporting agency and other information in relation to my/our commercial credit activities. Authority to exchange information with other credit providers In accordance with Section 18N(1)(b) of the Privacy Act, I/we authorise NAB to give to and obtain from credit providers named in this credit application and credit providers that may be named in a credit report issued by a credit reporting agency information about my/our personal or commercial credit arrangements. I/We understand this information can include any information about my/our creditworthiness, credit standing, credit history or credit capacity that credit providers are allowed to give or receive from each other under the Privacy Act. I/We understand the information may be used to notify other credit providers of a default by me/us. Authority and Declaration Authority [where NAB requires further information] I/We authorise NAB to seek any additional information it may require (including any information required to verify my/ our identity) from my/our accountant, solicitor, adviser, bank, other financial institutions or contact person named in this Application, and I/we authorise my/our accountant, solicitor, adviser, bank, other financial institution or contact person to supply such information. Declaration [Personal information about an individual]i/we declare that where I/we have provided personal information about an individual (such as an employer, relative, spouse/partner, solicitor or contact person), I/we have made or will immediately make the individual, aware of that fact and: That their personal information has been collected by NAB for the purpose of providing me/us with the product or service which is the subject of this Application (including assessing my/our Application) and managing and administering the product or service and protecting against fraud; That their personal information may be disclosed to other organisations involved in the provision, management or administration of my/our product or service as required by law or with their consent; that I/we may not be able to obtain the product or service the subject of this Application if that individual s personal information is not provided; that the individual can gain access to their personal information by contacting NAB; and give the individual NAB s contact details. [Insolvent, bankruptcy]i/we declare that I/we have never been insolvent nor committed any act of bankruptcy or entered into any assignment, composition or arrangement for the benefit of creditors and that there is no unsatisfied judgement in any court against me/us. [Content of the Application Form] I/We declare that I/we have read the particulars which have been completed in this Application and declare that those particulars and the information in the accompanying documents are true, correct and complete. I/We acknowledge that the representations made in this Application have been made to NAB to induce NAB to grant financial accommodation to the Applicant(s) named in the Application and to enable NAB to determine whether or not to grant such financial accommodation. 2012 National Australia Bank Limited ABN 12 004 044 937 AFSL and Australian Credit Licence 230686 89506A0612 Page of 9